Over the last year, we have seen a trend in spear phishing attacks that aim to steal valuable employee payroll information. Many recent attacks have focused on stealing the US W-2 tax form information. Here are some recent examples:
The messaging app hit the headlines when it’s payroll department handed over confidential information on current and former employees to a scammer impersonating the CEO.
An isolated phishing email also led to Seagate Technology being tricked into handing over the W-2 tax documents on all current and past employees, which contained confidential information on social security numbers and salaries.
The legal and reputational impact of such breaches can be far reaching and have significant financial impact. Unfortunately, the one-two punch of a data breach means that the worst may not yet be over for employees who have had their personal details stolen. Identity theft often follows data breaches as hackers use the confidential information they have accessed in the initial attack to facilitate a variety of frauds.
Reducing the risk of phishing attacks
Here are our top tips on how organisations can better protect themselves to reduce risk:
- Greater collaboration
- Remember, it could be you!
- Know your strongest assets
- Introduce new controls
- Restore trust in the digital ecosystem
When it comes to spear phishing, enterprises are not the only targets. UK consumer association, Which? revealed that people receive up to 20 phishing emails a month and it remains one of the most common – and successful – methods of scamming.
In April, the IRS issued a warning about scam artists masquerading as official bodies and enticing people to click on links containing questions about their 'tax refund'. A similar trend was observed in the UK, with research revealing that up to 40 per cent of people had received a phishing scam around the time of the deadline for filling in self-assessment tax returns.
Government, bank, and brand fraud
Increasingly, fraudsters are targeting specific individuals with sophisticated spoofs pretending to be from government departments, banks and major brands. Often the emails will have ‘Attention’, ‘Important Notification’, or ‘Your account has been revoked’ in the subject line and the growing reliance on email means it’s becoming progressively difficult for consumers to distinguish between mimics and genuine correspondence.
Consumer fraud countermeasures
As a result, the onus is on businesses to protect their brand reputation and restore trust in the inbox. Any organisation that relies on email to communicate with its customers, citizens, or members needs to implement the DMARC standard to prevent spoofing of their email addresses.
The standard provides businesses with a wealth of threat intelligence whenever somebody attempts to spoof their email addresses so they can take action to stop it happening again in the future.
John Wilson, Field CTO, Agari
Image source: Shutterstock/wk1003mike